November 7, 2026
What’s new in MockForge 0.3.241: CVE exposure labs
MockForge 0.3.241 expands managed CVE labs with data-driven pack definitions, clearer evidence and verdicts, and support for lab workflows that use self-signed targets or air-gapped hosts.
CVE packs describe their own checks
Each pack now declares its catalog entry and evidence checks as data. The lab recorder can forward POST bodies, which body-injection reproductions require. Only reviewed packs are available. This release includes the managed Next.js CVE-2025-29927 lab. PHP2Shell and Node2Shell are planned and are not shipped in this release.
Runs show a plan, then a plain verdict
mockforge cve run prints its recorder endpoint and target before starting, and warns when the default localhost bind cannot receive traffic from a remote load balancer. The final result states whether the target is EXPOSED or NOT exposed, gives the reason, and lists each evidence check. Evidence is also stored in report.json.
TLS and air-gapped lab hosts
For self-signed lab targets, --skip-tls-verify opts out of certificate verification for control requests and the test client. Verification stays enabled by default; the active flag prints a warning and the setting is recorded in the report. The managed labs guide now explains exporting pinned images with docker save, loading them on the isolated host, and using prepare to verify their digests without pulling.
Other fixes and changes
- Cloud tunnels refuse unauthenticated cloud destinations.
- Bundled demo samples serve their real image responses.
- Stripe subscription webhooks reconcile ordered subscription state and handle API-version changes, repeated and unknown events, and prices.
- Protocol support is split out of transport builds, reducing compilation for builds that do not need every protocol.